Contents

• GNU/Linux
  • Desktop/Laptop
  • Audiocasts/Shows
  • Kernel Space
  • Applications
  • Instructionals/Technical
  • Games
  • Desktop Environments/WMs
• Distributions and Operating Systems
  • PCLinuxOS/Mageia/Mandriva/OpenMandriva Family
  • Fedora Family / IBM
  • Debian Family
  • Canonical/Ubuntu Family
  • Devices/Embedded
  • Open Hardware/Modding
  • Mobile Systems/Mobile Applications
• Free, Libre, and Open Source Software
  • Web Browsers/Web Servers
    • Mozilla
  • Openness/Sharing/Collaboration
    • Open Access/Content
  • Programming/Development
    • Python
• Leftovers
  • Science
  • Education
  • Hardware
  • Health/Nutrition/Agriculture
  • Proprietary
  • Pseudo-Open Source
    • Openwashing
  • Security
    • ...

I watched this a few years ago. I was thinking about rewatching it for this blog series, but I should probably wait a bit more before rewatching it? So Im not.

Anyway, its an amazing movie, so the odd thing here is that it hasnt featured on the Sight & Sound directors list before. But the 2022 list has a number of more experimental films than the 2012 list, so I guess it makes sense in that context.

These are the directors that voted for it. And Gaspar No and Frank Oz? Yes, I can see how both those directors would enjoy it. But now Im wondering how Ozs list looks like.

...

It perhaps goes without saying that one nuclear bomb can really ruin your day. The same is true for non-nuclear dirty bombs, which just use conventional explosives to disperse radioactive material over a wide area. Either way, the debris scattered by any type of radiation weapon has the potential to result in thousands or perhaps millions of injuries, for which modern medicine offers little in the way of relief.

...

Graham Cluley Security News is sponsored this week by the fab folks at Kolide. Thanks to the great team there for their support! Right now, Zero Trust is in serious danger of becoming an empty buzzword. The problem isnt just that marketers have slapped the Zero Trust label on everything short of breakfast cerealits that Continue reading "Can zero trust be saved?"

read the original post at Read More 

The post The Linux Foundation Announces WasmCon Event Focused on WebAssembly Technologies appeared first on Linux.com.

Tufin announced the R23-1 release of its Tufin orchestration platform. The latest release extends security teams visibility and control into the cloud, enabling enterprises to better bridge the gaps between network and cloud security. With R23-1, Tufin customers can confidently accelerate application delivery and rapidly respond to network access requests, all while optimizing security. Tufin R23-1 automates security policy changes and provides real-time visibility into the impact of those changes, from on-premise to cloud. This More

The post Tufin R23-1 prevents security blind spots with improved network access automation appeared first on Help Net Security.

A new botnet called Dark Frost has been observed launching distributed denial-of-service (DDoS) attacks against the gaming industry. "The Dark Frost botnet, modeled after Gafgyt, QBot, Mirai, and other malware strains, has expanded to encompass hundreds of compromised devices," Akamai security researcher Allen West said in a new technical analysis shared with The Hacker News. Targets include

Zyxel has released software updates to address two critical security flaws affecting select firewall and VPN products that could be abused by remote attackers to achieve code execution. Both the flaws  CVE-2023-33009 and CVE-2023-33010  are buffer overflow vulnerabilities and are rated 9.8 out of 10 on the CVSS scoring system. A brief description of the two issues is below - CVE-2023-33009 -

Issues around zoned storage for filesystems was the topic of a combined storage and filesystem session at 2023 Linux Storage, Filesystem, Memory-Management and BPF Summit led by Bart Van Assche, Viacheslav A. Dubeyko, and Naohiro Aota. Zoned storage began with the advent of shingled magnetic recording (SMR) devices, but is now implemented by NVMe zoned namespaces (ZNS) as well. SMR devices can have multiple zones with different characteristics, with some zones that can only be written in sequential order, while other, conventional zones can be written in any order. The talk was focused on filesystems using the sequential type of zones since the conventional zones are already well-supported in Linux and its filesystems.

"https://lwn.net/Articles/849538/">folios is intended to, among other things, make it easy for the kernel to manage chunks of memory in a number of different sizes. So far, though, that flexibility is not being used in the kernel's handling of anonymous pages. At the 2023 Linux Storage, Filesystem, Memory-Management and BPF Summit, Yu Zhao and Yang Shi ran a session in the memory-management track aimed at charting a path toward support for anonymous pages in a variety of sizes.

upstart writes:

Our favorite SBC makes waves in the world of science:

The Raspberry Pi is a flexible system with use cases ranging from retro gaming platforms to industrial use cases for factories and more. Today we're sharing one research team's foray into science with the help of our favorite SBC and looking at how well it compares to modern, more expensive tools. Liam Taylor, Duncan Quincy, and Mark Smith recently deployed a set of Raspberry Pis to help monitor glacier calving in both Iceland and Peru.

According to the team, monitoring calving fronts is critical as extreme changes can result in environmental impacts for local residents. For example, things like tsunamis, floods, and the collapse of icebergs can cause serious damage, and monitoring these changes can help those living nearby respond before the problems worsen. Part of their research was to test the performance of a Raspberry Pi in monitoring these changes against more conventional tools they usually use, in this case, an unoccupied aerial vehicle (UAV).

To test the Pi against the UAV monitoring system, the team traveled to Fjallsjkull, Iceland. Here they could survey glaciers both from the shore and from a boat. The area also had a great variety of calving margin heights that made it easier to test the accuracy of the Raspberry Pi.

The Raspberry Pis were tested using both a Camera Module V2 and an HQ Camera Module using a 16mm telephoto lens. The Camera Module V2 proved too inadequate for their measurements, so the team opted to stick with the HQ Camera Module. The UAV chosen to compare against the Pi was a DJI Mavic 2 Pro UAV. The Raspberry Pis were then attached to a tripod with critical components like batteries stored inside a weatherproofed box.

The team mounted some of the Pis to a boat as they passed by while the UAV moved overhead. Recording the glaciers simultaneously allowed the team to get an accurate comparison of the charting ability of both devices. Using the pictures taken by the Pi, the team created a 3D render of the glaciers using photogrammetry.

---

Original Submission

Read more of this story at SoylentNews.

Security updates have been issued by Debian (python2.7), Fedora (maradns), Red Hat (devtoolset-12-binutils, go-toolset and golang, httpd24-httpd, jenkins and jenkins-2-plugins, rh-ruby27-ruby, and sudo), Scientific Linux (git), Slackware (texlive), SUSE (cups-filters, poppler, texlive, distribution, golang-github-vpenso-prometheus_slurm_exporter, kubernetes1.18, kubernetes1.23, openvswitch, rmt-server, and ucode-intel), and Ubuntu (ca-certificates, calamares-settings-ubuntu, Jhead, libhtml-stripscripts-perl, and postgresql-10, postgresql-12, postgresql-14, postgresql-15).

A China-linked APT group, tracked as Volt Typhoon, breached critical infrastructure organizations in the U.S. and Guam without being detected.

China-linked APT cyber espionage group Volt Typhoon infiltrated critical infrastructure organizations in the U.S. and Guam without being detected. The group managed to maintain access without being detected for as long as possible.

According to Microsoft, the campaign aims at building capabilities that could disrupt critical communications infrastructure between the United States and Asia region in the case of future crises.

The Volt Typhoon group has been active since at least mid-2021 it carried out cyber operations against critical infrastructure. In the most recent campaign, the group targeted organizations in the communications, manufacturing, utility, transportation, construction, maritime, government, information technology, and education sectors.

The APT group is using almost exclusively  living-off-the-land techniques and hands-on-keyboard activity to evade detection.

In order to conceal malicious traffic, the threat actor routes it through compromised small office and home office (SOHO) network devices, including routers, firewalls, and VPN hardware. The group also relies on customized versions of open-source tools for C2 communications and stay under the radar.

Volt Typhoon targets internet-facing Fortinet FortiGuard devices to achieve initial access to targeted organizations. Then the attackers attempt to extract credentials to an Active Directory account used by the compromised device and use them for lateral movement by authenticating to other devices.

Upon gaining access to a target environment, the group conducts hands-on-keyboard activity via the command line...

IBM engineers have been working through some multi-block allocator improvements for the EXT4 file-system driver. In particular, they aim to address some shortcomings that were discovered when running various tests on IBM POWER hardware with a 64k block size...

Weve all been there before you need some 3D printable design that you figure must be common enough that somebody has already designed it, so you point your browser to Thingiverse or Printables, and in a few minutes youve got STL in hand and are ready to slice and print. If the design worked for you, perhaps youll go back and post an image of your print and leave a word of thanks to the designer.

Afterwards, youll probably never give that person a second thought for the rest of your life. Within a day or two, theres a good chance you wont even remember their username. Its why most of the model sharing sites will present you with a list of your recently downloaded models when you want to upload a picture of your print, otherwise theres a good chance you wouldnt be able to find the thing.

Now if you really liked the model, you might go as far as following the designer. But even then, there would likely be some extenuating circumstances. After all, even the most expertly designed widget is still just a widget, and the chances of that person creating another one that youd also happen to need seems exceedingly slim. Most of the interactions on these model sharing sites are like two ships passing in the night; it so happened that you and the creator had simil...

Corvus Insurance has unveiled Corvus Signal, the risk prevention solution that brings together brokers, policyholders, and Corvus security experts in partnership. Corvus Signal has been shown to reduce cyber breach frequency and cost by up to 20 percent. The announcement comes amid increasing market activity and interest in combining cyber insurance with risk management services. Corvus Signal is the solution that demonstrates such an approach can bend the loss curve. For more than three years, More

The post Corvus Signal provides continuous threat analysis, tailored alerts and always-on recommendations appeared first on Help Net Security.

A hospital with 2,000 employees in the E.U. deployed Cynet protections across its environment. The hospital was in the process of upgrading several expensive imaging systems that were still supported by Windows XP and Windows 7 machines. Cynet protections were in place on most of the Windows XP and Windows 7 machines during the upgrade process, ensuring that legacy operating systems would not

An unnamed government entity associated with the United Arab Emirates (U.A.E.) was targeted by a likely Iranian threat actor to breach the victim's Microsoft Exchange Server with a "simple yet effective" backdoor dubbed PowerExchange. According to a new report from Fortinet FortiGuard Labs, the intrusion relied on email phishing as an initial access pathway, leading to the execution of a .NET

Via: 60 Minutes:

United Launch Alliance (ULA) is gearing up for a critical test firing of its next-generation rocket after a recent fueling check, and it could happen as soon as this week.

On Monday morning (May 22), Bruno stated on Twitter that the companys new Vulcan Centaur rocket was returning to Space Launch Complex 41 at Cape Canaveral Space Force Station. Now that the rocket is back at the pad, Vulcans static fire test (in which the rockets engines are ignited while it remains on the ground) could happen any day. We are targeting as soon as tomorrow for the Flight Readiness Firing, a representative from ULA told Space.com on Tuesday (May 23), but it will depend on range availability. On Wednesday (March 24), ULA CEO Tory Bruno intimated on Twitter that the test could happen as soon as Thursday (March 25).

Robotic bee that can fly fully in all directions like a real bee.

---

Researchers build bee robots that can twist.

I was surprised to receive an email this week telling me that I had renewed my annual subscription for McAfee virus protection. Would you, or a member of your family, have fallen for this scam?

Sent out last week by Alexandre Bailon with Bay Libre is the AI Processing Unit "APU" Direct Rendering Manager driver to interface between CPUs and AI Processing Units. The hope is this APU driver could be re-used by various hardware drivers while the initial focus is on bringing up the AI capabilities of the MediaTek MT8183 SoC...

By Owais Sultan

In this article, we will explore how cross-chain DEXes are revolutionizing the crypto market and levelling the playing field for traders of all backgrounds.

This is a post from HackRead.com Read the original post: How Cross-Chain DEXes are Democratizing the Crypto Market?

Going back to 2020 has been work by Intel's open-source engineers on implementing Key Locker support for Linux. Intel Key Locker allows for encrypting/decrypting data with an AES key without having access to the raw/actual key. AES keys are converted into handles with Intel Key Locker that can then be used for carrying out encryption/decryption on that system until revoked or system state changes. Intel engineers on Wednesday posted their seventh iteration of the patches for supporting Key Locker on Linux...

upstart writes:

Weed killers of the future could soon be based on failed antibiotics:

A molecule that was initially developed to treat tuberculosis but failed to progress out of the lab as an antibiotic is now showing promise as a powerful foe for weeds that invade our gardens and cost farmers billions of dollars each year.

While the failed antibiotic wasn't fit for its original purpose, scientists at the University of Adelaide discovered that by tweaking its structure, the molecule became effective at killing two of the most problematic weeds in Australia, annual ryegrass and wild radish, without harming bacterial and human cells. This research has been published in the journal Communications Biology.

"This discovery is a potential game changer for the agricultural industry. Many weeds are now resistant to the existing herbicides on the market, costing farmers billions of dollars each year," said lead researcher Dr. Tatiana Soares da Costa from the University of Adelaide's Waite Research Institute.

"Using failed antibiotics as herbicides provides a short-cut for faster development of new, more effective weed killers that target damaging and invasive weeds that farmers find hard to control."

Researchers at the University's Herbicide and Antibiotic Innovation Lab discovered there were similarities between bacterial superbugs and weeds at a molecular level.

They exploited these similarities, and by chemically modifying the structure of a failed antibiotic, they were able to block the production of amino acid lysine, which is essential for weed growth.

"There are no commercially available herbicides on the market that work in this way. In fact, in the past 40 years, there have been hardly any new herbicides with new mechanisms of action that have entered the market," said Dr. Andrew Barrow, a postdoctoral researcher in Dr. Soares da Costa's team at the University of Adelaide's Waite Research Institute.

[...] It's not just farmers who could reap the benefits of this discovery. Researchers say it could also lead to the development of new weed killers to target pesky weeds growing in our backyards and driveways.

"Our re-purposing approach has the potential to discover herbicides with broad applications that can kill a variety of weeds," said Dr. Barrow.

Journal Reference:
Mackie, Emily R. R., Barrow, Andrew S., Giel, Marie-Claire, et al. Repurposed inhibitor of bacterial dihydrodipicolinate reductase exhibits effective herbicidal activity [open], Communications Biology (DOI: 10.1038/s42003-023-04895-y)

---

...

A Brazilian threat actor is targeting more than 30 Portuguese financial institutions with information-stealing malware as part of a long-running campaign that commenced in 2021. "The attackers can steal credentials and exfiltrate users' data and personal information, which can be leveraged for malicious activities beyond financial gain," SentinelOne researchers Aleksandar Milenkoski and Tom

In a ground-breaking experiment, scientists from the University of Groningen, together with colleagues from the Dutch universities of Nijmegen and Twente and the Harbin Institute of Technology (China), have discovered the existence of a superconductive state that was first predicted in 2017.

They present evidence for a special variant of the FFLO superconductive state in the journal Nature. This discovery could have significant applications, particularly in the field of superconducting electronics.

The lead author of the paper is Professor Justin Ye, who heads the Device Physics of Complex Materials group at the University of Groningen. Ye and his team have been working on the Ising superconducting state. This is a special state that can resist magnetic fields that generally destroy superconductivity, and that was described by the team in 2015.

A fluxonium qubit can keep its most useful quantum properties for about 1.48 milliseconds, drastically longer than similar qubits currently favoured by the quantum computing industry.

By Karmela Padavic-Callaghan

Scientists at EPFL have found a new way to create a crystalline structure called a density wave in an atomic gas. The findings can help us better understand the behavior of quantum matter, one of the most complex problems in physics. The research was published May 24 in Nature.

Cold atomic gases were well known in the past for the ability to program the interactions between atoms, says Professor Jean-Philippe Brantut at EPFL. Our experiment doubles this ability. Working with the group of Professor Helmut Ritsch at the University of Innsbruck, they have made a breakthrough that can impact not only quantum research but quantum-based technologies in the future.

Scientists have long been interested in understanding how materials self-organize into complex structures, such as crystals. In the often-arcane world of quantum physics, this sort of self-organization of particles is seen in density waves, where particles arrange themselves into a regular, repeating pattern or order; like a group of people with different colored shirts on standing in a line but in a pattern where no two people with the same color shirt stand next to each other.

The National Security Agency (NSA) and Five Eyes partner agencies have identified indicators of compromise associated with a Peoples Republic of China (PRC) state-sponsored cyber actor dubbed Volt Typhoon, which is using living off the land techniques to target networks across US critical infrastructure. Volt Typhoon loves living off the land The joint cybersecurity advisory provides an overview of hunting guidance and associated best practices. It includes examples of the actors commands and detection signatures. More

The post Five Eyes agencies detail how Chinese hackers breached US infrastructure appeared first on Help Net Security.

North Korea-linked APT group Lazarus actor has been targeting vulnerable Microsoft IIS servers to deploy malware.

AhnLab Security Emergency response Center (ASEC) researchers reported that the Lazarus APT Group is targeting vulnerable versions of Microsoft IIS servers in a recent wave of malware-based attacks.

Once discovered a vulnerable ISS server, the attackers leverage the DLL side-loading (T1574.002) technique to execute a malicious DLL (msvcr100.dll) that they have placed in the same folder path as a normal application (Wordconv.exe). Then the library is executed via the Windows IIS web server process.

The msvcr100.dll is contained within the import DLL list of Wordconv.exe, this means that the first DLL is loaded in the memory of the Wordconv.exe process when it is executed.

the functionality of msvcr100.dll involves decrypting an encoded PE file (msvcr100.dat) and the key (df2bsr2rob5s1f8788yk6ddi4x0wz1jq) that is transmitted as a command-line argument during the execution of Wordconv.exe by utilizing the Salsa20 algorithm. reads the analysis published by ASEC. The decrypted PE file is then executed in the memory. It then performs the function of clearing the malicious DLL module that was loaded through the FreeLibraryAndExitThread WinAPI call before deleting itself (msvcr100.dll).

The researchers noticed important similarities between the msvcr100.dll and the cylvc.dll previously detailed by ASEC and related to another Lazarus campaign.

The threat actor exploited an open-source Notepad++ plugin called Quick Color Picker (a discontinued project) to establish a foothold in the target network before creating additional malware (diagn.dll).

The diagn.dll received the PE file encoded...

A clever phishing campaign aimed at stealing users business email account credentials by impersonating OpenAI, the company behind the ChatGPT chatbot, has been spotted by Inky researchers. The attack ChatGPT has quickly gained popularity and is used widely by individuals and organizations. Thats enough of a reason for cybercriminals to impersonate the brand. The initial phase of the attack involves the victim receiving an email that appears legitimate, purportedly sent by OpenAI. The email requests More

The post Phishing campaign targets ChatGPT users appeared first on Help Net Security.

When Virgin Orbit filed for bankruptcy in April, it was clear the commercial launch provider was in serious trouble. Despite successfully putting four payloads into low Earth orbit, the spin-off of Richard Bransons Virgin Galactic space tourism company had struggled to achieve a high enough launch cadence to become profitable, and had recently suffered a highly-publicized failure when their first launch from the UK from the newly-completed Spaceport Cornwall ended in a complete loss of the vehicle.

There was some hope that a buyer would swoop in and save them at the last minute, but now that the bankruptcy auction has spread out the companys assets among several other players in the commercial launch industry, Virgin Orbital is officially no more. With future launches now off the table, the companys remaining employees are set to be let go as operations wind down over the coming weeks.

...

In today's digital landscape, browser security has become an increasingly pressing issue, making it essential for organizations to be aware of the latest threats to browser security. That's why the Browser Security platform LayerX is hosting a webinar featuring guest speaker Paddy Harrington, a senior analyst at Forrester and the lead author of Forrester's browser security report "Securing The

The threat actors behind the nascent Buhti ransomware have eschewed their custom payload in favor of leaked LockBit and Babuk ransomware families to strike Windows and Linux systems. "While the group doesn't develop its own ransomware, it does utilize what appears to be one custom-developed tool, an information stealer designed to search for and archive specified file types," Symantec said in a